Threats tagged 'ghsa-9922-j5r7-r6hp'

A vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.7 allows any authenticated user with Subscriber-level access or higher to disclose payment details of any member. This occurs because the plugin does not perform capability or nonce checks on one of its payment-related AJAX actions, enabling authorization bypass via user-controlled keys.